[ryota-murakami]

Refs #139 (Cycle 0057, a feature cycle: first of its three pull requests, per Owner decision O1). pt2 adds the node-server profile through MCP; pt3 adds the skill route and the native trial N57. This PR does not close #139.

{
  "schema_version": 1,
  "pr": 140,
  "head": "b2b07d1064e584c555d9326d131f2f34124a58f6",
  "version": "0.2.50.0",
  "base": "origin/main",
  "gate": {
    "tests": {
      "pass": 7480,
      "fail": 0,
      "skip": 6
    }
  },
  "session_kind": "interactive",
  "pregate": "warn @b64fe053face (6 checks, current for b2b07d1064e5)",
  "issues": {
    "fixes": [],
    "refs": [
      139
    ],
    "flakes": []
  },
  "docs": {
    "status": "current",
    "scope": "AGENTS.md, CHANGELOG.md, README.md, extension/README.md, extension/skills/codebook/SKILL.md (PRODUCT_GOAL.md and the v9 PNG read-only); re-audit of base 5b992ea5 through b2b07d10"
  },
  "review_loop": {
    "passes": 3,
    "blocking_found": 6,
    "deferred": 0,
    "noted": 0,
    "fixed": 16,
    "scope": "frozen"
  }
}

Refs #139 (Cycle 0057, a feature cycle: first of its three pull requests, per Owner decision O1). pt2 adds the node-server profile through MCP; pt3 adds the skill route and the native trial N57. This PR does not close #139.

Summary

When a learner asked the chat to explain a login or a database call, every value Codebook captured went to the chat AI, Output › Codebook and the saved history as it was: a password in a variable, a Bearer header, a database URL with its password, a private key a test printed. The product goal says credentials stay out of chat and evidence; nothing enforced it.

Now one redaction contract runs before every place Codebook publishes or saves a captured value, in every profile (browser, test, and the coming server profile):

• Secret-named values read [masked] with everything inside them: names ending in a secret word (password, secret, token, authorization, cookie, credential, session, …), keys named for a secret use (apiKey, AWS_SECRET_ACCESS_KEY, signingKey) and sessionId, also inside an object preview. tokenCount, sortKey, publicKey and primaryKey stay visible.
• Credential-shaped text reads [masked] in values, debugger snapshots, test output, the development server's log, failure causes and Output › Codebook: URL passwords, JWTs, Bearer tokens, provider keys (sk-, Stripe, GitHub, Slack, Google, npm, AWS) and private-key blocks.
• Streams are redacted as they arrive. Output is masked per channel before it is cut or stored, so a secret split across chunks is still caught; text that cannot become a secret is released at once, so output keeps its order around a debugger stop.
• The editor's own debugger still shows the learner the real values; saved studies and replays are not rewritten.

The same PR lands the parts the server profile in pt2 builds on, unexposed (no profile, tool or help offers them yet): the node-server declaration with every refusal rule, the launcher with Part A's Stop v2 close order (detach the debugger, then SIGTERM), and the listener tool that reads which process listens on a port.

Blast radius

The redaction sits on the publication paths of the existing browser and test profiles (captureReplayDebugSnapshot, inspectNodeTestVariables, inspectConfiguredValues, launchNodeTest, launchDevelopmentServer, sanitizeCause, formatCodebookDiagnostic), so a value those runs captured may now read [masked] where it showed before. That is safe for stored data because no reader of saved studies or replays changed (script ran: the full suite, including every existing browser and node-test replay test, passes unchanged at ffaf4a5f). The server modules have no caller yet (file:line read: no import outside their tests).

Test Coverage

CODE PATHS                                                   USER FLOWS
[+] nodeServerConfigSchemas / describeIssues /               [+] Agent declares a node server
    requestPathProblem / addStopInspectionIssues               ├── [★★★ TESTED] valid GET/POST/monorepo declarations
  ├── [★★★ TESTED] every path rule, port, entry, body,         ├── [★★★ TESTED] refused declaration lists all violations + help
  │   stops (7 max, value required), message format            └── [★★★ TESTED] stop inspections on additional stops
[+] resolveNodeServerLaunch                                  [+] Server start
  ├── [★★★ TESTED] tsx root/condition/js/missing/             ├── [★★★ TESTED] owned launch, inspector, release, group closes
  │   outside-link/missing entry                              ├── [★★★ TESTED] early exit, spawn failure
[+] launchNodeServer / buildNodeServerEnvironment /          └── [★★★ TESTED] environment allowlist
    watchOwnedProcess
  ├── [★★★ TESTED] launch, env allowlist, exit, spawn error [+] Port ownership check
[+] captureProcessOutput                                       ├── [★★★ TESTED] dual-stack + loopback; ss; unknown reasons
  ├── [★★★ TESTED] overflow + onOutput throw                  ├── [★★★ TESTED] IPv6 zone/bracket, malformed, oversize
  ├── [★★★ TESTED] code-point event cut + sequence            └── [★★★ TESTED] real lsof/ss on this machine
  ├── [★★★ TESTED] announcement/tail 32 KiB caps (gap closed) [+] Secret handling
[+] listenerToolPath/readPortListeners/parse*/split*          ├── [★★★ TESTED] name rule, text patterns, chunk splitting
  ├── [★★★ TESTED] platform picks, failure mapping, parsing    ├── [★★★ TESTED] bracket/quote/optional-chain paths, type mode
  ├── [★★★ TESTED] ss IPv6 family (gap closed: defect fixed)  └── [★★★ TESTED] debugger/browser/node-test facts, diagnostics
[+] redaction (isSecretName/Path, redactSecretText,
    redactInspectedValue, redactValuePreview,
    createOutputRedactor) + wiring
  ├── [★★★ TESTED] names, text, previews, hold/drop limits, wiring in 5 callers

COVERAGE: 30/30 paths tested after the parent closed the audit's 2 gaps | GAPS: 0

• Tests: 491 → 492 files (+1 new file, captureProcessOutput.test.ts); the review rounds then added tests in the existing files, each red without its fix.
• Coverage: 93% value-weighted at the audit (93% including 0 weakly covered paths); the two remaining gaps were closed by the parent (f4cc12be, 60b9e018).
• Test value: 1 test written, 3 rejected by the authoring gate (covered elsewhere), 2 existing tests extended, 0 paths weakly covered.
• Regression proof — the ss IPv6 family test fails at HEAD before f4cc12be · passes at base not run (base control off: tsc build) · passes after fix f4cc12be.
• Tests ran: tests 7486 (runner summary of the exact-HEAD gate's pnpm test at b2b07d10: 7480 pass, 0 fail, 6 skipped).
• Changed existing tests, with reasons: redactionContract's inspected-path row items[0].sessionId → items[0].publicKey (sessionId became a secret name by the pass 1 security finding); two post-limit tests resume at a punctuated line and the "trailing partial word is held" test became "a trailing plain word is released at once while a URL waiting for its password is held" (Step 11 findings, 1ff1d2d1); credential-shaped fixtures are joined at run time so the secret scan reads no literal (98233ef2, ffaf4a5f, same values). After /ship: launchNodeServer's allowlist assertion also accepts NODE_V8_COVERAGE, only when the test process itself has it set — Node's spawn copies that variable into every child while coverage is collected, so the gate's pnpm health and CI shard 13/14 failed (d4b12d7b; red 4/5 with it set, green 5/5 with and without).

Pre-Landing Review

/ship Step 9 ran three fixing cycles and did not converge (converged:false, the cap). Under the owner's ship review limit (AGENTS.md, 2026-10-23), every finding of the last round (Step 9 pass 3 and Step 11) was fixed, Minor and below included; no Critical or Major defect stays open, so no Issue records one.

• Pass 1 (core checklist, 6 specialists, red team, QA smoke): 2 CRITICAL fixed in 9270c855 (the secret-name rule missed keys such as AWS_SECRET_ACCESS_KEY, signingKey, passphrase, sessionId; the browser profile's dev-server log reached the application.closed journal and failure messages unredacted), plus 4 informational fixed (more provider key prefixes, a narrower fail-closed trigger, named port constants).
• Pass 2: 2 CRITICAL fixed in 22c84cf7 (the private-key drop counted its kept tail twice, so a key in small chunks could release its body; a line after an oversized key in the same chunk was dropped, found by the QA probe), plus 6 notes fixed (dev-server stderr and end-flush tests, UTF-8-safe tail cut, port constants).
• Pass 3: 2 untested state cells (CRITICAL by the checklist) closed with tests in ecf0fd09; no behaviour change.
• Step 11 (Claude adversarial, Codex adversarial, Codex structured review): 11 findings, all fixed in 1ff1d2d1 — a quadratic regex on crafted key labels; a space-padded private key releasing its body after the drop limit (reproduced with an Ed25519 key); a URL password released after a long user name; an AWS key anchor that differed between the two matchers; a carry splitting a surrogate pair; the dev server's held tail lost when the process exits before its stream ends; held output re-stamped out of order; a type inspection's kept variable and a length-prefixed preview left unmasked; block mode opened on any -----BEGIN; the >16 KiB key trade-off.
• After /ship, the exact-HEAD gate and the local CodeRabbit CLI on the final range found three more things, all fixed: the launcher test under coverage (d4b12d7b, above); pnpm health scored the request schema's anonymous body-rule arrow at CRAP 56 because Fallow matched no coverage to it, so the rules became one named rule list with the same messages (22d6ba33); CodeRabbit r4's 3 Minor findings — a server's last http://127.0.0.1:4100 without a line break was masked whole at the stream's end, now a URL whose port closes its authority is released there while a URL cut off after a user name stays masked (red first), and the packaged README's recovery table now names NODE_SERVER_SOURCE_REFUSED (b2b07d10).
• Review binding: the reviews do not bind to the final tree (each round's fixes changed it; no fourth cycle is allowed). The exact-HEAD gate, CI and the local CodeRabbit CLI ran on the final tree b2b07d10 (results in Test plan).

REVIEW_LOOP: passes=3 blocking_found=6 deferred=0 noted=0 fixed=16 scope=frozen

Gate edits: 11 listed, 2 read, 0 findings — the package.test.mjs hunk strengthens the VSIX check (no fixture in the package; kept), and nodeTestConfigSchemas.ts's stop-inspection rule moved to addStopInspectionIssues with the same validation (kept).

Outside review: Codex adversarial completed (5 P1, fixed); Codex structured review completed (gate FAIL with 3 P1, fixed in 1ff1d2d1). Hosted CodeRabbit is off from this cycle (owner, 2026-10-27). Local reviews: open-code-review delegate 32/32 files (4 low, fixed e575399a); local CodeRabbit CLI r1 (1 major, fixed ee7c5866), r2 (1 trivial, fixed 8d03fce3), r3 on ffaf4a5f (0), r4 on d4b12d7b (3 Minor, fixed b2b07d10), r5 on the final range origin/main..b2b07d10 (0 findings).

Exploratory QA

Functional smoke against real processes (report-only folders under the Mac's ignored .gstack/qa-reports/):

• Pass 1 (c57-pt1-ship-pass1): PASS 2/2 — a real launch of the pinned switch-time clone through launchNodeServer with Stop v2's close (port freed), and the refusal wording of a bad declaration.
• Pass 2 (c57-pt1-ship-pass2): the published verdict is FAIL — captures 002/003 found a line after an oversized key block dropped with it; repaired red-first in 22c84cf7, captures 004–006 PASS.
• Step 11 (c57-pt1-step11): PASS — the real launch again and an unterminated-key probe after the 1ff1d2d1 fixes.
• Not run: any native editor trial (none is owed by pt1; N57 belongs to pt2 and pt3).

Design Review

No frontend files changed — design review skipped.

Eval Results

No prompt-related files changed — evals skipped. (The bundled skill stays 1.0.50.)

Scope Drift

Scope Check: CLEAN (pt1 per O1: tasks 5–8 and pt1's docs).

Plan Completion

pt1 scope of #139 (O1): 7 items — 4 DONE (tasks 5, 7, 8 and the Part A record), 1 CHANGED (task 6's fixture server is TypeScript compiled with the tests, still excluded from the VSIX and asserted by package.test.mjs), 1 PARTIAL at audit time and done since (task 14's pt1 CHANGELOG and README), Part A confirmed by its verdict comment on #139.

Issues

Refs #139

Verification Results

Step 8.1's checks: AC 2(a) the fixture launcher test — PASS in the gate's suite and in CI; AC 5 the existing browser and node-test replay tests — PASS unchanged; AC 8 the 15-check exact-HEAD gate on b2b07d10, required CI and the local CodeRabbit CLI on the final range, and AC 10 health:static and health — results in Test plan below.

Documentation

Status: current. No edits; read-only audit of base 5b992ea through HEAD b2b07d1 (committed content; the working tree is clean).

Scope: extension/README.md (Masked values section, recovery table), CHANGELOG.md 0.2.50.0 entry, and extension/src/utils/createOutputRedactor.ts as the source of truth for the redaction behavior after b2b07d1.

Documentation health:

• extension/README.md: current. Masked values still matches the redactor (a URL password is masked and the user name stays; text that cannot be a secret is released at once). The NODE_SERVER_SOURCE_REFUSED recovery row matches extension/src/errors.ts and the CHANGELOG compatibility line.
• CHANGELOG.md: current. Every user-visible behavior the 0.2.50.0 entry names has a README sentence.

Commits d4b12d7 (test only) and 22d6ba3 (refactor, same messages) need no doc change.

Coverage debt: none new. Diagram drift: none.

Test plan

The 15-check exact-HEAD gate (AGENTS.md Commands and checks, AC 8), with LANG=en_US.UTF-8, ran on b2b07d10 (tree b64fe053), every check exit 0 and the tree clean before and after:

• Pre-gate Stage 1 (gstack-pregate --stage preflight --allow-repo-commands, secrets scan) on tree b64fe053: WARN, exit 0 — MEDIUM non-credential findings only (localhost test URLs, example internal hostnames in tests, Slack sample digits read as a phone number)
• pnpm format:check, pnpm typecheck, pnpm lint, pnpm health:static, pnpm dupes, pnpm dead-code: each exit 0
• pnpm test: 7486 tests, 7480 pass, 0 fail, 6 skipped
• Reader DOM checks (node extension/scripts/<check>-qa.mjs verify <new folder>): study-bootstrap 288/288, wiki-reader-dom 55/55, study-reading-pose 12/12, understanding-focus 8/8, repository-return 26/26 cases passed
• pnpm test:package: 1081 tests, 1071 pass, 0 fail, 10 skipped
• pnpm health (alone): exit 0, measured suite 7486 tests (7480 passed, 6 skipped), health score 85 A, no finding above the measured baseline
• node --test .codex/restore-product-context.test.mjs: 9/9
• Required CI on b2b07d10: every check passes (Build, Format, Lint, TypeCheck, Test 1–14/14, Fallow health/dupes/dead-code, Reader DOM cases, package, Socket Security); hosted CodeRabbit skipped by policy (O6), split-files runs only on main pushes
• Local CodeRabbit CLI on the final range origin/main..b2b07d10 (r5): 0 findings

Earlier gate runs, kept as evidence: at ffaf4a5f pnpm health was refused (the launcher test under coverage) and 4 Reader DOM checks could not start their recording (Playwright's ffmpeg missing from this Mac's cache; installed with playwright-cli install-browser ffmpeg, CI's Reader DOM passed); at d4b12d7b pnpm health reported the CRAP finding fixed in 22d6ba33.

Honesty inventory: Gate edits: 11 listed, 2 read, 0 findings; Tests ran: tests 7486 (runner summary of the gate's pnpm test on b2b07d10); converged:false (ship review limit; no open Critical or Major).

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: laststance/codebook
• Branch: codex/cycle-0057-pt1
• File: .coderabbit.yaml
• Commit: b2b07d1
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 4c5680d2-4ef4-447e-98db-edbb737eb65a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}